Latest / CYBR.Signal / Cyclical Attack Methods

Transcript

Cyclical Attack Methods · CYBR.Signal

• 0:00
  SPEAKER_00: And hello, everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Hope you're doing well.
• 0:04
  SPEAKER_00: So I wanted to talk about kind of what I see as maybe a cyclical type of, I don't know, trend at the right word, but basically a cycle where some of these attacks are coming back to where they used to be in a way.
• 0:18
  SPEAKER_00: So what do I mean by that?
• 0:20
  SPEAKER_00: So uh on the podcast recording that Sam and I did, HUSECTCAS, that's should be out on uh May 1st, I believe, we talked to our guests on there about the new, I guess, vector, but not new vector, that attackers are taking, which is specifically at network defenses, going through them to get to to do the initial compromise into an environment.
• 0:51
  SPEAKER_00: Um, so that is cyclical in one way, but one way it's not.
• 0:54
  SPEAKER_00: And this is what I mean.
• 0:55
  SPEAKER_00: So it's cyclical in the fact that back when I first started in security, information security, all of those things, I it was a lot of the network defenses weren't hardened down very well.
• 1:09
  SPEAKER_00: Um, you had a lot of people had kind of it wasn't immature for the day, but just we hadn't learned our lessons on the rule sets that we put in and our firewalls.
• 1:19
  SPEAKER_00: We had we didn't have intrusion detection and prevention real early on.
• 1:25
  SPEAKER_00: So there were ways for the attackers to do the initial compromise straight into the network.
• 1:31
  SPEAKER_00: Uh, there it was just full of holes.
• 1:34
  SPEAKER_00: So after years and years and years, we've matured that, we've matured the technology.
• 1:40
  SPEAKER_00: A lot of people have put in next generation firewalls.
• 1:43
  SPEAKER_00: They put in IDS, IPS, they've put in um network detection response, they put anything in, they can look into the network and pick out metadata that's happening, all these things.
• 1:55
  SPEAKER_00: So that whole vector of attack has not been closed.
• 1:59
  SPEAKER_00: Obviously, nothing's ever closed, but is it's very, very, very well defended.
• 2:03
  SPEAKER_00: So, what we saw is a lot of attackers pivoting to phishing in order to get somebody to click a link or drive-by attacks where somebody or you know, malvertising or something to get somebody to click on a button so they could get their initial compromise via malware into that environment.
• 2:22
  SPEAKER_00: And yeah, I don't have to go through all of that.
• 2:24
  SPEAKER_00: Uh, everybody on here pretty much gets it, but that was basically the pivot because that network layer had been locked down.
• 2:30
  SPEAKER_00: So now what we're seeing is some new attacks going to the network layer directly to the network layer for the initial compromise, but not because it's full of holes in the configuration way it used to be, or we don't have the right technology.
• 2:47
  SPEAKER_00: It's because though we're seeing what I think is a little bit of a trend, and hopefully it slows way down of network devices and not just security devices, but devices on the network, things like you know, virtual machines and all kinds, and uh the hypervisor and those areas, and then um uh web application firewalls, regular firewalls, they're they have vulnerabilities in themselves.
• 3:17
  SPEAKER_00: So attackers are using those vulnerabilities in things that are network and security-focused devices that it seems weird that they have these vulnerabilities, but they're software like anything else, a lot of them, and um they do increase the attack surface.
• 3:35
  SPEAKER_00: So we're so that's what I mean.
• 3:36
  SPEAKER_00: It's cyclical, but not cyclical.
• 3:38
  SPEAKER_00: We're seeing attacks directly on the network layer, but what we're but it's not cyclical is because it's using vulnerabilities in those.
• 3:44
  SPEAKER_00: And that happened before too, but that really wasn't as common.
• 3:48
  SPEAKER_00: So you're seeing a lot of vulnerabilities, a lot of attacks in those, you're seeing vulnerabilities being exposed, hopefully early on, so those attacks don't hit them.
• 3:56
  SPEAKER_00: You don't have zero days in that, hopefully.
• 3:58
  SPEAKER_00: Um, but just an interesting kind of a cycle.
• 4:02
  SPEAKER_00: Uh, I use that word a lot, sorry, but uh it is kind of a cycle where we're basically what I've always said is you know, if we rest in one area where we think we have that locked down, and then we focus in another area to get that locked down from a overall security and technology perspective, um, and even an individual company perspective, you think you've got something locked down, you still have to pay attention to that area.
• 4:29
  SPEAKER_00: And if you don't, somebody's gonna exploit something in it.
• 4:33
  SPEAKER_00: There's always gonna be a new vulnerability that pops up.
• 4:36
  SPEAKER_00: Something happens and somebody figures something out, and they're able to attack from that vector that you thought you had pretty well protected.
• 4:45
  SPEAKER_00: So, anyway, let me know what you think.
• 4:47
  SPEAKER_00: Hopefully, not a trend.
• 4:48
  SPEAKER_00: Hopefully, uh we see some of this stuff getting locked down.
• 4:51
  SPEAKER_00: I will say this is not always, I mean, it quote unquote, the fault of the manufacturers, the vendors, um, because they're being asked to introduce a whole lot more different features to do different things.
• 5:07
  SPEAKER_00: And with that, all those features is always going to come.
• 5:11
  SPEAKER_00: Uh at some point, there's gonna be a compromise, a vulnerability there.
• 5:15
  SPEAKER_00: It just is what it is.
• 5:16
  SPEAKER_00: So, anyway, let me know what you think.
• 5:17
  SPEAKER_00: Talk to you next time.